Aggregator

Apache Dubbo Provider默认反序列漏洞（CVE-2020-1948） 0x01 搭建漏洞环境 漏洞介绍 2020年06月23日， 360CERT监测发现Apache Dubbo 官方发布了Apache Dubbo 远程代码执行的风险通告，该漏洞编号为CVE-2020-1948，漏洞

在那么多为了better life奋斗的人里面，总有几个是为了better world的。

银行卡信息读取器？太强了

武学大家治学传承心态赏析:扫地僧、风清扬、独孤...

员工离职，怎么留人？

do you kown

非预期解法：
$_SERVER['QUERY_STRING']; 未进行解码操作，可以直接绕过读 /var/www/html/flag.php

GET /?a=1&b=1&c=%66%69%6c%65%3a%2f%2f%2f%

互联网安全建设从0到1 发售，安全防御公众号正式运营

0x01 前言

前段时间由于给小破站开启了青少年模式，结果密码给忘记了。导致只能看一些学习课堂和书法之类的相关视频。虽然有找回密码选项，但是找回密码需要发送本人手持身份证的照片。而后在输入密码的时候试了多次，除了提示”密码输入错误，请重试”外，没有其他限制，也没有网络请求。由于是4位的数字密码，我想如果我写个自动输入密码的脚本，利用生成0000~9999的密码字典，应该就可以找到正确的密码。

On June 21, 2020, Akamai mitigated the largest packet per second (PPS) distributed denial-of-service (DDoS) attack ever recorded on the Akamai platform. The attack generated 809 million packets per second (Mpps), targeting a large European bank.

祝各位端午安康！

Micro-segmentation is the central IT security best practice response to overly-permissive policies. Learn how to do it right.

Verisign has been involved with an initiative known as Mutually Agreed Norms for Routing Security, or MANRS, since its inception. MANRS, which is coordinated by the Internet Society, focuses on strengthening the security and resiliency of IP networks throughout the world by identifying and providing best practices for mitigating common routing security threats. MANRS began […]

The post Verisign Expands MANRS Relationship to Strengthen Global Routing Security appeared first on Verisign Blog.

WAF(Web Application Firewall)对于从事信息安全领域的工作者来说并不陌生，在渗透测试一个目标的时候常常作为拦路虎让人头痛不已，笔者这段时间花了些精力对国内外比较常见的WAF进行了绕过研究，这只拦路虎其实也并没有想象

In a climate of rampant online fraud, protecting yourself from identity theft requires taking some simple, proactive steps and remaining constantly vigilant.

Using the cloud securely should be your primary concern - not the underlying security of the public cloud.

always surprises me how easily a community can adapt to a new situation or reality. What was once considered an outlier or even an unimaginable situation can quickly become our new normal. For those of us focused on protecting enterprises from threats, that also couldn't be more accurate. Specifically for the Akamai team working on our Prolexic platform in our Security Operations Command Center (SOCC), mitigating many distributed denial-of-service (DDoS) attacks a day has resulted in increasingly sophisticated automated tooling and expert-level know-how through mitigating these constant attacks.

always surprises me how easily a community can adapt to a new situation or reality. What was once considered an outlier or even an unimaginable situation can quickly become our new normal. For those of us focused on protecting enterprises from threats, that also couldn't be more accurate. Specifically for the Akamai team working on our Prolexic platform in our Security Operations Command Center (SOCC), mitigating many distributed denial-of-service (DDoS) attacks a day has resulted in increasingly sophisticated automated tooling and expert-level know-how through mitigating these constant attacks.

你保护不了你看不见的资产。

当渗透测试人员拿到shell后，如果要进一步渗透，信息收集是重中之重，内网渗透的深入程度取决于信息收集的深度，内网渗透的本质就是信息收集，而登录凭证的收集是信息收集的重点方向。关于linux系统下登录凭证收集的文章多为翻查文件。本文将研究